Disclosure-gate HARD RULE: check the PLATFORM report board for the repo, not just GitHub+CVE (2026-06-21, DB-GPT)

Miss: cycle274 DB-GPT unauth-RCE disclosure-gate was called CLEAN off GitHub issues/PRs + CVE/GHSA (0 hits for code_interpreter/react-agent). Whole cycle + a Docker live-E2E spent bulletproofing it. When the operator opened huntr.com/repos/eosphoros-ai/db-gpt to FILE, the board showed: (1) cash = $0 all severities, (2) 25+ reports = hunting graveyard, and BOTH our finding primitives ALREADY reported by others: unauth leg = "Fake Authentication: get_user_from_headers Returns Admin Role" (xjin1020); code-exec leg = "Unauthenticated code execution via sandbox /execute endpoint" (nhomyk) + "Multiple Code Sandbox Security Bypasses" (lexi-core-ai). Our finding = those recombined -> near-certain DUPLICATE. HELD (not filed).

Root cause: same as RAGFlow (checked GitHub+CVE but not the platform report surface). GitHub issues/PRs + CVE search does NOT show huntr pending/duplicate reports.

HARD RULE (add to the deep-drill FLOOR, run EARLY as a cheap gate): 1. For ANY platform-listed repo (huntr/etc.), BEFORE deep-drilling or calling novel: open the platform's OWN report board for the repo (huntr.com/repos/) and read the full report list (incl pending + duplicate states). 2. A LONG board (many reports) = SATURATION SIGNAL = walk early (DB-GPT had 25+; should have walked before the whole cycle + E2E spend). 3. Check whether the finding's PRIMITIVES (auth bypass, the specific sink) are already individually reported there. If the constituent pieces are reported, a recombination = likely DUPLICATE. 4. Caveat: some boards are PRIVATE (Intigriti/HackerOne reports are NOT public) -> for those, rely on GitHub+CVE + obscurity + the platform's own dedup; note the residual dup-risk honestly. 5. Pair with the cash-gate: read the CURRENT $ tier on the same page (DB-GPT = $0 all severities).

Net: verified-and-held beats filed-and-marked-duplicate. The operator caught this pre-file; bank it so the gate catches it next time.